View Full Version : False positive for Smitfraud-C?
Hello,
It seems like 10/31/2007 SpyBot updates have a false positive for me. I never had this one before. Basically, it found Smitfraud-C. Ad-Aware SE Personal v1.06r1 (with all updates) didn't find anything odd either a few days ago. I posted the exported log and SpyBot results log in a zip file: http://alpha.zimage.com/~ant/temp/Spybot151ResultsAndReg.zip (will delete when my issue is fixed).
I am using Windows XP Pro. SP2 with all updates, IE6.0 SP2, SeaMonkey v1.1.5, SpyBot v1.5.1, etc. I did not repair the problem either.
Thank you in advance. :)
I'm uploading a small update without this troublesame detection for now, someone will look into details tomorrow :)
Thanks, PepiMK for looking into this and for your reponse and info.
Kavu2
I'm uploading a small update without this troublesame detection for now, someone will look into details tomorrow :)Thank you. Let me know if you still need information, but I am not at home to get it quickly.
Hello antdude,
please send us a complete bug report. In order to do so, please run Spybot - Search & Destroy and switch to Advanced Mode via the menu item Mode, let it scan, try to fix the problems (!) and then go to "Tools" --> "View Report". Tick all the 10 checkboxes (leave "Do not report disabled or known legitimate items" unchecked) you can find there and click on "View Report". Now choose "Export" and save the file to your desktop. Please attach this file to an email and send it to detections#spybot.info (replace # with @).
Thanks in advance!
Hello antdude,
please send us a complete bug report. In order to do so, please run Spybot - Search & Destroy and switch to Advanced Mode via the menu item Mode, let it scan, try to fix the problems (!) and then go to "Tools" --> "View Report". Tick all the 10 checkboxes (leave "Do not report disabled or known legitimate items" unchecked) you can find there and click on "View Report". Now choose "Export" and save the file to your desktop. Please attach this file to an email and send it to detections#spybot.info (replace # with @).
Thanks in advance!OK, I sent the logs to that e-mail address. :)
alexxmuller
2007-11-06, 01:43
I have the same false positive for smitfraud.c. evrytime i run spybot, it's telling me i have smitfraud.c and when I delete it, it deactivate my add or remove program and I can't use the add remove programs in order touninstall programs. the only way i can get back to my add or remove programs is by doing a system restore and when I do a spybot scan....smitfraud.c show up again.
Please help
I have the same false positive for smitfraud.c. evrytime i run spybot, it's telling me i have smitfraud.c and when I delete it, it deactivate my add or remove program and I can't use the add remove programs in order touninstall programs. the only way i can get back to my add or remove programs is by doing a system restore and when I do a spybot scan....smitfraud.c show up again.
Please helpCouldn't you just use restore in SpyBot?
alexxmuller
2007-11-06, 04:02
Couldn't you just use restore in SpyBot?
NO, when i do sbybot restore, I couldn't get back my add remove programs remove/change button..I have to do a system restore to get it back.
could anybody please help..... I still have the smitfraud.c .
spybot is picking it up and when i cleaned it, it messed up my add or remove programs remove/chnage button....I can't even unisntall programs after I clean smitfraud.c with spybot and other spyware scanners didn't pickup smitfraud.c
hello,
as PepiMK said earlier, there has been an update fixing this false positive.
Please use your system restore and then update Spybot S&D. Then scan and do not fix ,create a report (see Busters post) and attach the report here or send it to detections-at-spybot.info (replace -at- with @).
With the report we will be able to help you remove Smitfraud-C.
Hello Yodama...
I also had previously posted(in the duplicate thread) about the Smitfraud-C item:
-------------------
Smitfraud-C.: [SBI $72299D84] Settings (Registry key, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\
---------------------
I updated the 'small update' from PepiMK(11/01/07 ?)...however the Smitfraud-C item still showed in subsequent scans. I have not let SpybotSD 'fix' it. I tried a WindowsXP system restore, but the item still showed. I uninstalled SpybotSD and reinstalled, updated, scanned and it still shows. I have had no ill effects that I can see on the computer...everything *seems* to be working fine.
I have now checked for updates, re-scanned, viewed report, exported and saved the report. I will email it to the 'detections' email addie listed above.
Thank you in advance for assisting in this matter.
Kavu2
I will send a log, thanks for your info on this issue. I checked for updates using spybot 1.5 however no updates were found. I guess they will be released on Wednesday (today) like usual? My computers works fine and i have no problems with my desktop or background that Smitfraud-C is supposed to cause. My info can be found on this thread ALONG with another problem i am experiencing.
http://forums.spybot.info/showthread.php?t=19767
Did you already download today´s updates? :scratch:
>Yodama et al...
Follow up posting (11/07/07)...
Today's SpybotSD update seems to have resolved my Smitfraud-C issue as it longer shows up after the update and subsequent scan.:
'Congratulations! No immediate threats were found'
Thank you to the Spybot team for their time and efforts...much appreciated! :bigthumb:
Kavu2
sry about that i was talking about on monday and tuesday i checked for updates on spybot and there were none. I then remembered you guys release updates on Wednesday. I am updating spybot now and i will scan. I'll let you guys know if Smitfraud-C shows up still. Also, for ppl not knowing, if someone else removed this item and never knew there add/remove programs stopped working, (cause thats what happened to me when i removed it, luckily i checked it.) would the update you release fix that? and undo what spybot did when it removed this item? j/w ;) thanks :)
and it no longer shows up!! :bigthumb: thanks alot guys for your hard work and help and support. just wanted to let you know your updates worked fine. :)